Guides

Platform Management quickstart

Create and govern standard API keys and guardrails with a RunAPI management key.

Platform Management lets account administrators create, inspect, update, and revoke standard API keys and guardrails without using the dashboard for every change.

Create a management key

Create a management key from the Management Keys page, then store it separately from standard application keys. Send it as a bearer token only to Platform Management endpoints.

HTTP

Authorization: Bearer YOUR_MANAGEMENT_KEY

A standard API key cannot call key or guardrail management endpoints. A valid management key can still receive 403 Forbidden when its owner no longer has the required account role.

List standard API keys

Use GET /api/v1/keys to inspect keys visible to the management key’s account:

SHELL

curl "https://runapi.ai/api/v1/keys" \
  -H "Authorization: Bearer YOUR_MANAGEMENT_KEY"

Use returned public identifiers for later retrieve, update, revoke, or guardrail-assignment requests. Never infer access from a key name or masked token.

Create and rotate a key

Create an application key with POST /api/v1/keys. The full secret is returned only in the create response, so persist it in your secret manager before discarding that response. Rotation should create a replacement, deploy it to the application, verify traffic, and then revoke the old key.

SHELL

curl -X POST "https://runapi.ai/api/v1/keys" \
  -H "Authorization: Bearer YOUR_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"Production worker"}'

Apply guardrails

Guardrails are reusable account policies for model, provider, and spending controls. Manage policies through /api/v1/guardrails, then use /api/v1/guardrail_assignments to attach or remove them. Treat a rejected assignment as a policy or ownership failure instead of silently continuing without the guardrail.

Handle management errors

401 Unauthorized means the credential is missing, malformed, revoked, or invalid.
403 Forbidden means the credential class or account role cannot perform the operation.
404 Not Found means the requested resource is not visible to the authenticated account.
422 Unprocessable Content means one or more submitted values violate a resource rule.